fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope

[objectstack-fleet]

Fixes #21079
Clause-②: yes (narrowing)

Ruling E (5933054144, maintainer 「同意E」) as written: this card lands the deny baseline alone. The anonymous public-form picker is retired on its own card, #21180. Execution parameters are seat 1's release 5934091842, and the claim is 5934758335. The claim revision 5937041708 records the seat's route B and adds two surfaces: the two out-of-surface picker pins and the in-place delegator-arm fix. Patch round 1 implements both. ⚠️ Disclosure discipline applies (security family). This body states classes, positions, codes and statuses only. Every reading is private, in the dev's scratch space.

What this changes

For a non-system caller that carries a principal (a position, a named permission set or a user id) and resolves no permission set, an empty set list is now the ADR-0056 D2 deny baseline. The answer is the same at every layer, and no layer has a door-specific copy of it:

• Object admission. The engine middleware's step 2 CRUD gate is no longer guarded on a resolved set. The evaluator answers the empty list as it answers any list, so the caller is refused with the PERMISSION_DENIED / 403 any ungranted caller gets. canReadObject, canExport and canWriteObject answer false for it.
• Row scope. getReadFilter answers the deny sentinel for it, as its failure paths already did.
• The one exception. isPrincipalLessContext is the one exception an empty list has. The middleware hands a principal-less context through, as before, and the three probes admit only that context. getReadFilter now reads the same predicate instead of an inline copy. ADR-0096 stages that context separately, and it is unchanged.
• Contract. The ISecurityService docblocks in packages/spec/src/contracts/security-service.ts narrow to match: canReadObject's arm list and its Fails CLOSED paragraph, canExport's Fails CLOSED paragraph, getMetadataReadableFields's "why the two differ" paragraph, and a deny-baseline paragraph on getReadFilter. No key, method, parameter, return type or export changes.

Positions that stay as they are (phase 0's N3, re-derived on this tree):

• step 1.5 (the capability gate), step 2.6 (the depth stash), steps 2.7, 2.8 and 3.6, and the delegator resolution all stay guarded on a resolved set. Ungated, the depth stash would answer 'org' for an unmatched list, which widens.
• checkAuthoredRowWrite still answers 'abstain' for the empty list.
• computeLayeredRlsFilter is unchanged.
• Every field-level answer (security(plugin-security): for a caller who resolves no permission set, the field-projection answers say no masking rule reaches it, while maskingRule's describe and the result masker mask it — which one a public door serves is not measured #20995 / security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer #21063) is unchanged. The comments that described the old admission are corrected.

A bounded in-place fix in the same class (declared here, as the four conditions require). Three probes skipped the D10 delegator CRUD-grant arm when the delegator resolved no set: canReadObject arm 6, canWriteObject arm 8, and the canExport intersection. The middleware asks that arm over the delegator's empty list and refuses. Measured privately before the change: on an embedder with no baseline, an agent acting on behalf of a delegator who resolves no set was refused by the middleware (PERMISSION_DENIED / 403) while all three probes answered true. The fix drops the length guard on those three arms, so they read the same evaluator answer. The capability arms' delegator guard is left as it was, because the grant arm dominates it and no pin can observe it. The four conditions:

1. It is the same defect class (an empty set list grants by absence).
2. The fix is mechanical, and its shape is pinned by the middleware's own expression.
3. The file is this claim's.
4. It needs no new verification surface, because the same suites cover it.

The claim revision 5937041708 adds these three arms to the claim's file surface.

Measured (private; classes and positions only)

Measured on base 0b12b9ea and after the change. The engine-level probe drives the registered middleware and the three probes, and asks getReadFilter, for each member:

caller class	before	after
guest envelope, deployment with no guest set	admitted (find, insert); probes true; no row scope	refused 403 PERMISSION_DENIED; probes false; deny sentinel
picker-shaped context, its named set not registered	admitted; probes true; no row scope	refused 403; probes false; deny sentinel
signed-in user, baseline disabled, no grant	admitted; probes true; no row scope	refused 403; probes false; deny sentinel
context naming only unresolvable sets, no user id	admitted; probes true; no row scope	refused 403; probes false; deny sentinel
agent for a delegator who resolves no set	middleware refused; probes true	middleware refused; probes false
principal-less context (boundary)	admitted	admitted (unchanged)
signed-in member with a set (control)	granted object admitted, ungranted refused	unchanged
picker-shaped context, its named set registered (control)	admitted by the set	unchanged

Door-level consequences (N4). These are measured on real bootStack boots, with plugin-security built at each leg and the build checked by ablation-dist-preflight:

• Stock showcase doors are unchanged. 26 dogfood files are green on both legs: the 13 shared-showcase files plus 13 isolated showcase and security files (persona matrix, authz conformance, public form, public-form read-back masking, the declared showcase endpoints, the default profiles, and others). The other 3 files in the set are the moving ones.
• The app-declared anonymous endpoint goes from 200 to 403 PERMISSION_DENIED on a deployment with no matching set. It still passes the authentication gate, so it answers 403, not 401.
• The public-form picker goes from 200 to 403 PERMISSION_DENIED on a deployment without the set it names.
• A signed-in user on a baseline-disabled embedder loses the everything-default. The record read and every query answer 403 PERMISSION_DENIED.
• The public form submit is unaffected. Its grant admits ahead of object admission.
• Fork clause: not triggered. No stock-boot door was found that serves this class. The measurement is the dogfood showcase harness on both legs. A real pnpm dev -- --fresh boot was NOT MEASURED this round; phase 0 measured 24 anonymous doors on one.

Pins

New: zero-set-deny-baseline.test.ts (18 cases). It covers each measured member (the guest envelope, a picker-shaped context, and a signed-in user on a baseline-disabled embedder). For each member it pins the premise (zero sets), that all seven engine operations are refused at object admission before they run (code and status), that the three probes answer false, and that the row scope is the deny sentinel. The controls are a set-holding member (admitted to its granted object, refused the other) and a registered named set. The principal-less context is pinned as the boundary. The second-principal case is pinned with a set-holding delegator as its control. No pin title states a request.

Moved: 21 plugin-security cases in 5 files and 4 dogfood cases in 2 files, the same set phase 0 named and re-derived on this tree. Under route B there are also 5 picker cases in 2 more files (see the next section). Each now asserts the new answer's substance:

• zero-set-masking.test.ts (9) and zero-set-capability-fold.test.ts (9). The field projections still exclude masked and capability-gated fields. Every query, read and write is now refused at object admission (PERMISSION_DENIED / 403), and the read's row scope is the deny sentinel. In the fold suite, explain agrees: object_crud denies, allowed is false, and fls still reports the field hidden. canWriteObject still equals the middleware, field for field. The masked-echo case was refused 400 at the echo gate and is now refused 403 at admission, ahead of it. No refusal assertion was weakened.
• can-write-object-admission.test.ts (1). The org-bound zero-set twin is now denied by arm 4. The pin adds the middleware's own refusal (code and status).
• get-writable-fields.test.ts (1). The field answer is unchanged. Every write the case names is refused at admission (code and status).
• predicate-related-read-tenant-scope.test.ts (1). The write door's refusal is unchanged. The preview is now refused at its write gate, because canWriteObject answers the public-form grant context false (the grant is not one of its arms). The pin asserts that probe answer directly and keeps the "identical whatever the value" and "related columns never read" assertions.
• Dogfood declarative-endpoint-policy (2). The explicit authRequired: false endpoint passes authentication, and its object read is refused 403 PERMISSION_DENIED. The declared cache directive is not on that refusal. The success side of that directive stays pinned in the runtime units and the showcase file.
• Dogfood zero-set-masking (2). The picker door and the baseline-disabled record door are refused at admission. The record door is checked on the read and on a query that names an unmasked field.

The picker-door case is shared with #21180. That card deletes the picker door and this dogfood case. Measured: an untouched picker case turns red under this change, so I re-pinned it to the deny baseline. I did not restructure it, and its fixture is untouched. The ruling gives this case to whichever card lands second. Under route B this PR is expected to land first, and #21180 then takes its own deletion of the case.

Route B: the two picker pins from #21062, re-pinned

PR #21136 (#21062) landed after phase 0's measurement. It added two picker pins, and both assume the picker serves a visitor with no session on a deployment with no matching set. Ruling E fixes no landing order between this card and #21180, which retires the picker. The seat ruled route B in claim revision 5937041708: this card re-pins both files and lands on its own clock. The reasons it gives:

• the picker has no producer outside spec, tests, docs and its own route, so the window in which the picker answers 403 costs nothing;
• spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180 has no PR yet, so waiting for it has no stated end.

Each fixture's intent is kept, and no case is deleted. #21180 deletes both files when it lands.

• packages/rest/src/public-form-lookup-picker-queryable-key.test.ts, 4 cases. The no-guest-set class moves out of the shared loop into its own describe.
  • The picker whose first display field is masked: its listing and its search each answer 403 with code: 'PERMISSION_DENIED', no row, and no stored value in the body.
  • The masked-only picker answers the same code and status as the engine's own refusal, and the engine is never asked. The pin also asks the engine for a query keyed on a field the caller MAY query on, which only object admission refuses. Without that line the case stayed green with the deny baseline put back; that was the first ablation run.
  • The no-masked-field control is refused too, and still keys on its first display field.
  • The premise and the "never keys on the masked field" cases are unchanged. The guest-set class and the lifted-rule class keep their pins as they were.
• packages/qa/dogfood/test/public-picker-queryable-key.dogfood.test.ts, 1 case. For a visitor with no session and for a signed-in caller, the listing and the search answer 403 PERMISSION_DENIED, with nothing served and no stored value in the body. The masked-only picker answers the same.

Ablations (one leg per negative pin)

Each leg used scripts/ablation-replace.mjs in wrap mode, and its own trap … EXIT INT TERM restored the file from HEAD on an absolute path. Each leg landed (anchor count 1 to 0, blob changed). The final state was blob a4a95715 equal to HEAD, with an empty git diff HEAD and a clean git status. Every leg ran on the plugin-security test files as they stand at 3e49b1af; this round does not change them:

leg (forbidden behaviour put back)	red
step 2 guard permissionSets.length > 0 && restored	23 of 139 (all 3 deny-baseline middleware pins, plus the moved middleware pins)
canReadObject arm 2 answers true	3 (the probe pins)
canWriteObject arm 4 returns through the organization wall	9
canExport arm answers true	3
getReadFilter zero-set line deleted	6 (the deny-sentinel pins)
delegator grant arm guarded on length, in canReadObject, canWriteObject and canExport (one leg each)	1 each (the second-principal pin)

The first attempt at the canExport delegator leg was a no-op: the replacement contained the anchor, and the tool refused it with exit 1 and nothing run. It was re-run with a non-overlapping anchor, and that run is the one in the table.

The picker leg (patch round 1). scripts/ablation-replace.mjs put back the base's step 2 guard. That guard is the only arm the picker door reads; the door asks getQueryableFields (unchanged) and then the engine. The wrapped child rebuilt plugin-security, and the preflight found the injected guard in 2 built files. Results:

• public-form-lookup-picker-queryable-key.test.ts: 4 of 19 red, exactly the 4 re-pinned cases.
• public-picker-queryable-key.dogfood.test.ts: 1 of 1 red.

The restore was proven: blob a4a95715 equals HEAD, git diff HEAD is empty, and after the rebuild the --absent preflight read the marker absent from all 6 built files and the tree clean. Both files then ran green again: 19/19 and 1/1.

The dist-level leg put base security-plugin.ts back (blob 970439f6, marker 3 to 0 in src), rebuilt, and ran the dogfood set. The 4 re-pinned dogfood cases were red, and the stock showcase files stayed green. It then restored and rebuilt, and the preflight found the marker in 2 built files again.

Gates and tests (at 03ae8604, after origin/main 097ef802 was merged as 2e1564f5)

• Gate list. dispatch-gates --commands derived 109 families on this head; the change set now has 14 paths. All 109 exit 0, and --ran reconciled them with recorded exit codes: 109 run, 0 NOT-MEASURED. check:dual-build-cjs-loads read the 8 packages it needs after they were built.
• plugin-security. 156 files, 3345 passed, 23 skipped. typecheck exits 0.
• rest. The full local project: 256 files, 4844 passed, 310 skipped. typecheck exits 0, and tsconfig.test.json lists the re-pinned file.
• dogfood. typecheck exits 0. The dogfood set from round 1 (30 files) is 314 passed and 0 failed, and that now includes the picker file.
• Spec. Unchanged since round 1, when the spec contract tests were 31/31 and check:generated reported all 15 artifacts up to date.
• Lint, narrowed.
  • The population comes from eslint.config.mjs (files: **/*.{ts,…} minus NEVER_LINTED). All 12 changed .ts files are in it, and --format json counts 12 files, 0 errors and 0 warnings.
  • The config enables no type-aware linting and this diff touches no lint configuration, so it cannot move the verdict on an untouched file. The repo-wide pnpm lint is CI's.

Docs (patch round 1)

The drift check (5936999532) listed 8 hand-written pages. I read all 8, then grepped content/docs/** (outside releases/ and the generated references/) and skills/** for sentences that say a caller with a principal and no resolved set is admitted, has no row scope, or falls through to sharing alone, or that say what the anonymous picker answers. Three passages in content/docs/ui/forms.mdx were made false by this PR, and they are rewritten. Only sentences about what the door answers changed; the text about the door's existence is #21180's.

• Section 2, the guest set. It said the guest set is only needed for the back-compat path, and that it should be INSERT-only. Now: that holds for the submit. A form with a public picker needs a guest set that grants read on the picker's target object, because without it the picker answers 403 PERMISSION_DENIED under the deny baseline. Any read granted there is readable by every anonymous visitor through the picker.
• The picker's errors table gains a 403 PERMISSION_DENIED row: no guest set grants read on the target object, so the search context resolves no set and is refused at object admission. The declaration bounds what is searched; it never grants the read.
• "Auth model" said the lookup's result set "is bounded by the picker declaration instead". Now: the declaration bounds what is matched and projected, the guest set authorizes the search, and without one the search is refused at object admission.

No other sentence was false. The other 7 drift-check pages either name the probes in the system-context bypass table (unchanged) or say nothing about a set-less caller. skills/objectstack-api describes authRequired: false as an authentication opt-out only, which is still true. Release-owned pages were read but not edited; none of the 4 the drift check names states the old zero-set admission.

Acceptance notes (observations, not filed)

• ADR-0087 marker. The changeset carries not-required (no-migration-prescription), and the gate accepts it. The ruling's migration text is a grant decision, not a rewrite of anything an author wrote, so objectstack migrate meta has nothing to rewrite. Phase 0 expected this category to be wrong under route D. This is the same reading as the security (P0 suspect): a non-system caller who resolves no permission set — an unauthenticated one included — is admitted to aggregate any object at an analytics door, object admission and row scope skipped #21061 and security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer #21063 changesets.
• A stale comment in packages/rest/src/rest-server.ts (the export and explain fail-stance docblock). It still says the middleware skips its CRUD gate for an empty resolution. Carrier: spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180, which edits that file. It is a comment only.
• A misleading preview message. When the write-gate probe refuses a caller, a traversing validation rule in the preview fails with a message that tells the author to fix the rule's condition. It does not say that the related read was withheld. This is existing behaviour for every refused caller, and this PR only adds callers to that class. Carrier: none.
• API-key principal: NOT MEASURED (as in phase 0). It carries a user id, so the baseline applies on a stock deployment.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/plugin-security, @objectstack/spec, touching 6 documentable anchor(s).

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/index.mdx (via ISecurityService (symbol, a top-level interface))
• content/docs/kernel/runtime-services/index.mdx (via ISecurityService (symbol, a top-level interface))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/sharing-rules.mdx (via getReadFilter (symbol, a method of class SecurityPlugin))
• content/docs/permissions/system-context.mdx (via canExport (symbol, a method of class SecurityPlugin), canReadObject (symbol, a method of class SecurityPlugin), canWriteObject (symbol, a method of class SecurityPlugin), getReadFilter (symbol, a method of class SecurityPlugin))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v15.mdx (via getReadFilter (symbol, a method of class SecurityPlugin))
• content/docs/releases/v17/17-0.mdx (via ISecurityService (symbol, a top-level interface))
• content/docs/releases/v17/17-5.mdx (via ISecurityService (symbol, a top-level interface), canReadObject (symbol, a method of class SecurityPlugin), canWriteObject (symbol, a method of class SecurityPlugin))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 097ef802700e109aa98a89c2991041516476b6f9 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7e6e4c2caf6d4cd0f209bc867e29affb5f9c3988 — the merge of head 03ae8604a894db1b7a3f36d34d9ad03904e30609 into base 097ef802700e109aa98a89c2991041516476b6f9, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7e6e4c2caf6d4cd0f209bc867e29affb5f9c3988 && git checkout 7e6e4c2caf6d4cd0f209bc867e29affb5f9c3988
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 097ef802700e109aa98a89c2991041516476b6f9 03ae8604a894db1b7a3f36d34d9ad03904e30609 && git checkout -B drift-repro 097ef802700e109aa98a89c2991041516476b6f9 && git merge --no-ff 03ae8604a894db1b7a3f36d34d9ad03904e30609

node scripts/docs-audit/affected-docs.mjs --json 097ef802700e109aa98a89c2991041516476b6f9

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 097ef802700e109aa98a89c2991041516476b6f9 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 03ae8604a894db1b7a3f36d34d9ad03904e30609
Local-runs: none

Inputs, and nothing else: card #21079 (body and all 12 comments through 5937906612), PR #21217 (body, the 14-file list, the net diff 097ef802...03ae8604, +722/−248), and the 42 check-runs on the head (38 success, 4 skipped — Auto Label and Check PR Size on one of their two runs, Console Pin Gate, the opt-in Packed-tarball smoke — 0 failure; Dogfood Regression Gate, Test Core, every Type Check job, Lint & Repo Gates, Check Changeset, Governed Surface Queue Guard, Spec property liveness and Build Docs all green). Ruling E 5933054144 (maintainer 「同意E」) is the governing text; the seat's route B revision 5937041708 and revision 2 5937093863 are the claim surface. Source positions below are git reads of the head, not runs. ⚠️ Security family: classes, positions, codes and statuses only.

① Derived judgments

Every accept-set change the diff implies, each named right or wrong against the head's source:

1. Step 2 CRUD gate, security-plugin.ts ~2516 — RIGHT. The resolved-set guard is gone; the gate now runs for every non-system caller the hand-through did not admit, and a principal-carrying caller with an empty list is refused PERMISSION_DENIED / 403 by the evaluator's answer to that list. The principal-less hand-through (isPrincipalLessContext, ~2216, return next()) and the publicFormGrant branch (~2043–2113, await next() then return) both precede the gate, so the ADR-0096 context and the public-form submit never reach it. The referential FK-clear exception is unchanged, and on that path step 2.6 still stands down (the narrowest answer).
2. canReadObject arm 2 (~5812), canExport (~6201), canWriteObject arm 4 (~6098) — RIGHT. Each answers isPrincipalLessContext(context) for an empty list. For the principal-less context the answer is unchanged (true; arm 4 already skipped its field arm for that context, and the organization wall is never asked without a user id). For a principal-carrying caller every answer narrows to false. No arm widens.
3. getReadFilter (~5389, ~5422) — RIGHT. The inline predicate it replaced (positions.length === 0 && explicit.length === 0 && !context?.userId) is byte-for-byte the body of isPrincipalLessContext (~352), so the hand-off is unchanged; the new deny-sentinel return for an empty list sits after resolution, inside the existing fail-closed try, and agrees with the middleware's refusal.
4. D10 delegator arms — canReadObject arm 6, canWriteObject arm 8, the canExport intersection — RIGHT, and in surface. The middleware's own D10 ask at ~2586 carries no length guard (if (delegatorSets && !checkObjectPermission(...))), so the three probes' length guard was a second spelling that admitted a delegator with no set while the engine refused. Dropping it narrows only. Claim revision 5937041708 records the three arms; same class, mechanical, pinned (the second-principal pair, a set-holding delegator as control), ablated one leg each.
5. Door consequences — RIGHT, and each one the ruling ordered or its migration text names. The app-declared authRequired: false endpoint: 200 → 403 PERMISSION_DENIED (authentication passed, refused at admission; the cache directive is not on the refusal). The public-form picker on a deployment without the set it names: 200 → 403 (the 5 picker pins from security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 re-pinned under route B; the ruling's own reading gives publicPicker no producer and no first-party caller, so the window to spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180 costs nothing). A signed-in user on a baseline-disabled embedder: every door 403. The public-form submit: unaffected (the grant branch admits ahead of step 2; 26 stock-showcase and security dogfood files green on both legs; Dogfood Regression Gate green on the head). Fork clause: not triggered.
6. One flip the PR names but a reader could miss — RIGHT, with no public door. canWriteObject now answers the public-form grant context false (the grant is not one of its arms by its docblock's design: no wire caller presents the grant to the preview). The only consumer is the plugin's own write-preview hook (~1359); the public form exposes GET /forms/:slug, POST …/submit and GET …/lookup/:field and no validate door, so the flip reaches the unit pin in predicate-related-read-tenant-scope.test.ts and nothing on the wire. That pin stays a refusal (preview invalid, the related user's columns never read) and adds the probe's answer directly.
7. Field-level answers — unchanged, as ordered. getReadableFields / getQueryableFields / getWritableFields / getMetadataReadableFields (security(plugin-security): for a caller who resolves no permission set, the field-projection answers say no masking rule reaches it, while maskingRule's describe and the result masker mask it — which one a public door serves is not measured #20995 / security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer #21063) keep their answers; the moved suites keep every field assertion and move only the door assertions to refusal at admission (the fold suite now also pins explain: object_crud denies, allowed false, fls still hidden). checkAuthoredRowWrite 'abstain', computeLayeredRlsFilter, step 2.6 and the step 1.5 capability gate are untouched.
8. Public surface — packages/spec/src/contracts/security-service.ts, docblocks only — RIGHT. Every changed line in that file is inside a /** … */ block: canReadObject's arm list and Fails-CLOSED paragraph, canExport's Fails-CLOSED paragraph, getMetadataReadableFields's "why the two differ" paragraph, and a new deny-baseline paragraph on getReadFilter. No method, parameter, return type, key or export moves; the arm order the canReadObject docblock states matches the implementation's six arms. check:api-surface, check:generated, Build Docs and Spec property liveness are green on the head.
9. Remaining zero-set spellings (the permissionSets.length guards at steps 1.5, 2.6, 2.7, 2.8, 3.6, the delegator resolution and the sharing-scope resolvers) are stand-downs now dominated by step 2 for a principal-carrying caller and by the hand-through for a principal-less one — not door-specific admission copies. The new isPrincipalLessContext docblock's "no second spelling" sentence reads them as absent rather than dominated; comment-only, not a contract matter.

No widening anywhere in the diff. Docs: the three content/docs/ui/forms.mdx passages are the ones the change falsified and now state the measured answers; #21180's seat has recorded the shared file (5937693582).

② Semver level

• Changeset .changeset/21079-zero-set-deny-baseline.md — matches what the diff publishes. @objectstack/plugin-security: minor and @objectstack/spec: minor, BREAKING banner, ! in the title: a runtime accept-set narrowing in plugin-security and a published-contract narrowing in spec (docblocks). minor for a BREAKING entry is the repo's launch-window convention (check-changeset-no-major refuses major; precedents throughout packages/spec/CHANGELOG.md, and the security (P0 suspect): a non-system caller who resolves no permission set — an unauthenticated one included — is admitted to aggregate any object at an analytics door, object admission and row scope skipped #21061 / security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer #21063 changesets at 2bddb19c / 665cab33). Two packages in one changeset is well-formed; Check Changeset is green on the head.
• Clause-②: line — yes (narrowing) in the PR body and in the changeset — RIGHT. The spec contract's stated answers narrow; this is the fix(plugin-security,spec)!: a caller who resolves no permission set is not served a capability-gated field, and the security contract says so #21134 precedent's spelling for a docblock-only contract narrowing and the spelling ruling E's execution parameters fix. Under the AGENTS.md grammar yes takes at least minor (held) and (narrowing) is BREAKING (held). The claim's bare Clause-②: yes (5934758335) is also well-formed (the arm is optional) and does not contradict it; the changeset carries the arm the gate reads.
• ADR-0087 marker not-required (no-migration-prescription) — RIGHT. The Migration. paragraph is the ruling's text verbatim and is a grant decision (declare and assign a set; resolve the guest anchor's bindings under security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158), not a FROM → TO rewrite of anything an author wrote: no authorable key, export, stored shape or wire shape is removed or renamed, objectstack migrate meta has nothing to reach, and no semantic entry could detect the condition in stored metadata (a missing grant is not a shape). ADR-0087's own text draws that line — a prescription for a source-code consumer or an operator is not the ledger's business — and the gate's detector asks for a rewrite arrow or an old/new column pair and finds neither. Phase 0's N7 expectation that the marker "would be wrong under route D" predates the ruling and read the migration text as a rewrite; the two precedent changesets in this family carry the same category, and check:adr-0087-registration is among the 109 derived families the dev reports at exit 0.
• The migration prescription AGENTS.md requires of a breaking changeset is present, and so is the implementer note for a third-party ISecurityService.

③ Boundary flags

Every dev flag (phase 0 5929705833, round 1 5936988829, patch round 5937906612, the PR body's acceptance notes) and every open_questions entry, answered or escalated:

• N6 (the route) → ruled E (5933054144); built as route D, the deny baseline alone. Answered.
• Q2 (whose guest anchor bindings on a multi-organization deployment) → not decided; travels with security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158 (on hold). Nothing in this diff depends on it. Answered by the ruling.
• Q3 (who edits the spec docblocks) → A, same PR, surface declared in the claim. Answered and done.
• Round-1 open question (two out-of-surface picker files) → seat ruled route B (5937041708); re-pinned, no case deleted, and the masked-only picker pin strengthened so it discriminates (its first ablation run was a no-op leg; re-run red after 335cae74). Answered.
• Zone 2 assumption 4 falsified (the picker-door case in zero-set-masking.dogfood turned red) → re-pinned with its fixture untouched; the ruling's serial clause gives the case to whichever of this card and spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180 lands second, and spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180's deletion wins at merge if it lands first. Answered.
• Bounded in-place fix (the delegator arms) → judged right in ① item 4 and recorded in the claim. Answered.
• Clause-② spelling and ADR-0087 marker → answered in ②.
• Real pnpm dev -- --fresh boot NOT MEASURED this round → acceptable: phase 0 measured 24 anonymous doors on a real stock boot with the same five-arm edit (every engine door 401 at authentication, the picker 403 LOOKUP_NOT_PUBLIC because the showcase declares none, the submit 201), this round measured the dogfood showcase harness on both legs, and the one addition since (the delegator arms) can only refuse. Residual, not a blocker.
• API-key principal NOT MEASURED → reasoned, not measured: it carries a user id, so the stock baseline applies and it is outside the class on objectstack serve; it joins the class only on a baseline-disabled embedder, which the migration text already covers. Residual, not a blocker.
• Misleading preview message (carrier: none) → ESCALATED to the seat: existing behaviour for every refused caller and diagnostic text only, so not a blocker here, but a finding with no carrier should be filed or given one; this PR only adds callers to the class that sees it.
• Stale rest-server.ts fail-stance docblock → carrier spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180, which edits that file. Answered.
• Attribution form, main merged twice without rebase, the peek ref created and deleted → process notes under AGENTS.md, not contract matters. Answered.
• spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180's pointer (forms.mdx is a fourth shared file) → recorded on both cards; whichever lands second removes the picker prose. Answered.
• Raise rule / fork clause → not triggered on either measurement; p1 stands. Answered.

Disclosure discipline held in the PR body, the changeset and the pins: classes, positions, codes and statuses; no pin title states a request.

Implemented-by: claude/issue-21079-zero-set-deny-baseline
Reviewed-by: session_01DiCSbmJrkzNhuEAier4VoJ

VERDICT: PASS